Don't have to use their proxy. My gateway router uses cloudflare to set the IP via the API and I just use self-signed certificates. A record resolves to my gateway, not some cloudflare server.
They also do a lot of work in the privacy space. Encrypted Client Hello to protect SNI came from them.
If you use any company for TLS termination they can MITM (e.g. AWS certificate manager).